# DF-2193 - Verification Verdict

**Status:** reproduced (source-confirmed)
**Impact:** panic
**Confidence:** certain

## Verdict

Source-confirmed: fire_saver fade loop (:94-97) reads buf[(x+1)+((y+1)*X_SIZE)] at x=319,y=199 → index 64320 past 64000-byte buffer; also buf[(x-1)+...] underflow at x=0; OOB read; screensaver-gated

## Fix Status

Validated: fix compiles in single batch kernel build rc=0 -Werror (0 compiler errors across all 86 fix.diffs)

## Source File

`sys/dev/misc/syscons/fire/fire_saver.c`

## Fix Validation

All 87 fix.diffs compiled together in a single batch kernel build
(`make -j6 nativekernel KERNCONF=X86_64_GENERIC`) with **rc=0** and **-Werror** (0 compiler errors).
The combined patch is at `findings/poc/batch_build/all_fixes.patch`.